Systems and methods for shared device access control

Patent metadata

Field	Value
Publication number	US-12445289-B2
Application number	US-202217591430-A
Country	US
Kind code	B2
Filing date	Feb 2, 2022
Priority date	Jun 14, 2021
Publication date	Oct 14, 2025
Grant date	Oct 14, 2025

Abstract

A method includes receiving, at an electronic device and from a second electronic device, a second root identifier, wherein the second root identifier is associated with a second profile tree maintained at the second electronic device and determining that a first root identifier does not match the second root identifier, wherein the first root identifier is based on a first profile tree maintained at the electronic device. The method further includes sending, to the second electronic device, the first profile tree, wherein the first profile tree comprises representation of currently maintained user profiles at the electronic device, receiving, from the second electronic device, user profile update information, and updating a subset of the currently maintained user profiles based on the user profile update information.

First claim

What is claimed is:

1. A method, comprising:
receiving, at a first electronic device associated with a first root identifier, a second root identifier from a second electronic device, wherein the first root identifier is based on a first profile tree maintained at the first electronic device, and wherein the second root identifier is associated with a second profile tree maintained at the second electronic device;
determining that the first root identifier does not match the second root identifier;
sending, to the second electronic device, the first profile tree, wherein the first profile tree comprises a representation of currently-maintained user profiles at the first electronic device;
receiving, from the second electronic device, user profile update information, wherein the user profile update information corresponds to user profile information maintained at the second electronic device and determined to be more recent than corresponding user profile information at the first electronic device; and
updating a subset of the currently-maintained user profiles based on the user profile update information.

2. The method of claim 1 , further comprising:
responsive to updating the subset of the currently-maintained user profiles, updating the first profile tree; and
generating an updated first root identifier based on the updated first profile tree.

3. The method of claim 1 , wherein the first profile tree comprises a Merkle tree generated from one or more hash tables of user profile data.

4. The method of claim 3 , wherein the first root identifier comprises a Merkle root of the first profile tree.

5. The method of claim 1 , further comprising:
detecting the second electronic device;
authenticating the second electronic device as a peer device of a shared device group; and
establishing a trusted connection with the second electronic device.

6. The method of claim 5 , wherein detecting the second electronic device comprises:
receiving an advertising message from the second electronic device,
wherein the advertising message comprises an identifier of the shared device group and at least a portion of the second root identifier.

7. The method of claim 5 , wherein establishing the trusted connection with the second electronic device comprises:
receiving, from the second electronic device, a group key for the shared device group; and
confirming that the group key for the shared device group received from the second electronic device matches a group key for the shared device group maintained at the first electronic device.

8. The method of claim 7 , further comprising:
responsive to confirming that the group key for the shared device group received from the second electronic device matches the group key for the shared device group maintained at the first electronic device, decrypting a biometric authentication profile for a user with the group key;
receiving, through a biometric sensor of the first electronic device, biometric information of the user;
authenticating the user by comparing the biometric information of the user against the biometric authentication profile for the user; and
sending a logoff message for the user to the second electronic device.

9. The method of claim 1 , further comprising:
receiving, at the first electronic device from a third electronic device, a third root identifier, wherein the third root identifier is associated with a third profile tree maintained at the third electronic device;
determining that the first root identifier does not match the third root identifier;
sending, to the third electronic device, the first profile tree;
receiving, from the third electronic device, second user profile update information; and
updating a second subset of the currently-maintained user profiles at the first electronic device based on the second user profile update information.

10. The method of claim 1 , further comprising:
subsequent to updating the subset of the currently-maintained user profiles based on the user profile update information, sending a report to a remote management console, wherein the report comprises at least one of per-profile metadata of the currently-maintained user profiles or per-device metadata based on the currently-maintained user profiles.

11. An electronic device associated with a first root identifier, the first root identifier based on a first profile tree maintained at the electronic device, the electronic device comprising:
at least one communication interface; and
at least one processor configured to:
receive, via the at least one communication interface, a second root identifier from a second electronic device, wherein the second root identifier is associated with a second profile tree maintained at the second electronic device,
determine that the first root identifier does not match the second root identifier,
send, to the second electronic device, the first profile tree, wherein the first profile tree comprises a representation of currently-maintained user profiles at the electronic device,
receive, from the second electronic device, user profile update information, wherein the user profile update information corresponds to user profile information maintained at the second electronic device and determined to be more recent than corresponding user profile information at the electronic device; and
update a subset of the currently-maintained user profiles based on the user profile update information.

12. The electronic device of claim 11 , wherein the at least one processor is further configured to:
responsive to updating the subset of the currently-maintained user profiles, update the first profile tree, and
generate an updated first root identifier based on the updated first profile tree.

13. The electronic device of claim 11 , wherein the first profile tree comprises a Merkle tree generated from one or more hash tables of user profile data.

14. The electronic device of claim 13 , wherein the first root identifier comprises a Merkle root of the first profile tree.

15. The electronic device of claim 11 , wherein the at least one processor is further configured to:
detect the second electronic device,
authenticate the second electronic device as a peer device of a shared device group, and
establish a trusted connection with the second electronic device.

16. The electronic device of claim 15 , wherein:
to detect the second electronic device, the at least one processor is configured to receive an advertising message from the second electronic device, and
the advertising message comprises an identifier of the shared device group and at least a portion of the second root identifier.

17. The electronic device of claim 16 , wherein, to establish the trusted connection with the second electronic device, the at least one processor is configured to:
receive, from the second electronic device, a group key for the shared device group, and
confirm that the group key for the shared device group received from the second electronic device matches a group key for the shared device group maintained at the electronic device.

18. The electronic device of claim 17 , wherein the at least one processor is further configured to:
responsive to confirming that the group key for the shared device group received from the second electronic device matches the group key for the shared device group maintained at the electronic device, decrypt a biometric authentication profile for a user with the group key,
receive, through a biometric sensor of the electronic device, biometr

Assignees

• Samsung Electronics Co Ltd

Inventors

• Tran Chu Ly
• Chen Xun

Classifications

• H04L9/0833

  involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065) · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• H04L9/0861

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04L9/3236 Primary

  using cryptographic hash functions · CPC title